nuclei-templates/http/misconfiguration/cloudflare-image-ssrf.yaml

id: cloudflare-external-image-resize

info:
  name: Cloudflare External Image Resizing Misconfiguration
  author: vavkamil
  severity: info
  description: Cloudflare Image Resizing defaults to restricting resizing to the same domain. This prevents third parties from resizing any image at any origin. However, you can enable this option if you check Resize images from any origin.
  reference:
    - https://support.cloudflare.com/hc/en-us/articles/360028146432-Understanding-Cloudflare-Image-Resizing#12345684
  tags: cloudflare,misconfig,oast
  metadata:
    max-request: 1

http:
  - raw:
      - |
        GET /cdn-cgi/image/width/https://{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
minor update 2021-05-09 15:06:52 +00:00			`id: cloudflare-external-image-resize`
Adding cloudflare-image-ssrf 2021-05-09 14:56:24 +00:00
			`info:`
minor update 2021-05-09 15:06:52 +00:00			`name: Cloudflare External Image Resizing Misconfiguration`
Adding cloudflare-image-ssrf 2021-05-09 14:56:24 +00:00			`author: vavkamil`
			`severity: info`
			`description: Cloudflare Image Resizing defaults to restricting resizing to the same domain. This prevents third parties from resizing any image at any origin. However, you can enable this option if you check Resize images from any origin.`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`reference:`
			`- https://support.cloudflare.com/hc/en-us/articles/360028146432-Understanding-Cloudflare-Image-Resizing#12345684`
oob tags update 2021-10-18 20:40:26 +00:00			`tags: cloudflare,misconfig,oast`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 1`
Adding cloudflare-image-ssrf 2021-05-09 14:56:24 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Adding cloudflare-image-ssrf 2021-05-09 14:56:24 +00:00			`- raw:`
			`- \|`
			`GET /cdn-cgi/image/width/https://{{interactsh-url}} HTTP/1.1`
			`Host: {{Hostname}}`
			`Accept: /`

			`matchers:`
			`- type: word`
			`part: interactsh_protocol`
			`words:`
			`- "http"`